General

  • Target

    v8LCmD3G.bat

  • Size

    195B

  • Sample

    191216-2j3v7dn8ej

  • MD5

    c92c184ca6583b05ef289ed468c3c77e

  • SHA1

    ea6dd3da0b80473948f1fbaf255dcec5d0abb0f1

  • SHA256

    89020b9c4772d552cedc03dabeb74aedbbd4dd6aff529044a0f671a74d47603b

  • SHA512

    686e24834473dc41be5110683578a729097edb09a8a3c08789dead4d244641a1e966c6d9f1175cd7598561b8d0ae27f69b9957234702d39461afc3f477bbf052

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/v8LCmD3G

Extracted

Path

C:\2hm436z-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension 2hm436z. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/6EC83003EAFB7AB2 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/6EC83003EAFB7AB2 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: CnZPPNiQ9Xp2iR5ZSpNR/7JjOIvtXWy8c3y2hi0q3bXSzYyAaOkzETa/Jp2Rjl6N d4D4zRybOBGevkLAp9cA6R7u2J5UrJydCFwt7uTFszYHUHITLHWyqeLWu9DzqFtF 38Iim8jPS7GtVY5QqrEW8Pmv59PjntmQXWqEIPUTuhJfhOOE1pTdt+5fXItbgXkZ Iv6EAhHcASt3Cq9njMdG5ywEqvEqMUhzYNTSqYbqt3A2oj2B/3260+1Lo6/M3dtE jiETOikiDBw/S9s+kxzz4pUu2AAtIN1vCU+2ZgCTjtucsP5ykQlt+64GzSyuzUUd 6lXQj7k3gSqYbqqOv/vGX7R81RP0dYFazCsYt2qXFoulFC7ofqzUaIOXDMoVt34R VQimRzFwiNr+AIG6jbBXrrHMu1NOfT7jcnHHsGsl9YoEtmP3vEKwDyf60+8oWKG1 ps3PfjcCBS38dsEzgR3hyDJJ0GK4vnIdD6iTEB4gDQ86MDkxmaLlCW+0ZFcSzDKl 4noLHggwcMoAkVwrX3ixDdj/qeYv0oUgneqeDWWcfTEyI2bb2fXb82kQZ84jvP3M BpN59O7Ct8IBPR08GIYWARXDmdqnNpNgMqcnnwuUtvsVudtRVhCFeCvJqA0ZdET+ jMZCufaOEEHJLGoJS9HaW389h816ARw5EkYyODZMJ2EA7j19XzFPzw7R2jElNEyh koMq09DdtW4bFxjJlAFBUs1P42T5yyxkA1wagVCBLhogfSCMZrjLQCmXcUjzru3B iPw2rjBjst9D5lTH66wjjYiKBXQwD1kUIocEVAeZ/hk9r3XWT6u+rwycJ1lQZAp7 GoXY26XSthQ/2wbHeL/bkdyu2FznSVUrjAc2729r4dQk53Y7ZFQw+MulFlFqSm0g qX96zfJbXoC+XJmG626HrdQfAaZ22GtLC+QoGIPvZ/MTig6zrl7sHzUPfaQIrFe/ jEYP2WMWv51BnlJXD+LdVc9S3dz+JfclgLY2XUiyURyuMlP5eGeQz3WAC+z/BiiC xdAWFGX1WSmiJNZigA8iYvYQEqb4Sq0eTPci0bbOdRcpgT0OCai4bLyUe/v8+2MF OEYvmwvEdxCNv1NC/OW2ZJTZQP5RPlt23hG2CZxh3bBgR9IYl5GtMCR/N/VP3YRk oMru3FkxWQc4EaXGKxw= Extension name: 2hm436z ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/6EC83003EAFB7AB2

http://decryptor.top/6EC83003EAFB7AB2

Targets

    • Target

      v8LCmD3G.bat

    • Size

      195B

    • MD5

      c92c184ca6583b05ef289ed468c3c77e

    • SHA1

      ea6dd3da0b80473948f1fbaf255dcec5d0abb0f1

    • SHA256

      89020b9c4772d552cedc03dabeb74aedbbd4dd6aff529044a0f671a74d47603b

    • SHA512

      686e24834473dc41be5110683578a729097edb09a8a3c08789dead4d244641a1e966c6d9f1175cd7598561b8d0ae27f69b9957234702d39461afc3f477bbf052

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Program crash

    • Windows security modification

    • Adds Run entry to start application

    • Checks for installed software on the system

    • Discovering connected drives

    • Modifies system certificate store

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks